Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119377SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
Low 2.5
In plain English
A low-severity incorrect authorization in SQLite from SQLite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.1%top 97.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119377 |
| Debian:13 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119377 |
| Debian:14 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119377 |
| Ubuntu:22.04:LTS | sqlite | no fix listed | UBUNTU-CVE-2026-119377 |
| Ubuntu:22.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119377 |
| Ubuntu:24.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119377 |
| Ubuntu:26.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119377 |
| Ubuntu:26.10 | sqlite3 | no fix listed | UBUNTU-CVE-2026-119377 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://sqlite.org/bugs/info/2026-07-05T08:15:45Z issue-tracking
- https://sqlite.org/src/info/bbd69ce274620008 patch
- https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237 patch
- https://sqlite.org/src/info/2cb22877683680c1 patch
- https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8 patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775 technical-description
- https://sqlite.org/releaselog/3_54_0.html release-notes
- https://abraxaslabs.tech/research/sqlite-fj-using-auth third-party-advisory
- https://github.com/sqlite/sqlite product
- VulnCheck Advisory: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING third-party-advisory